Phone Number Injections

Applications often treat a phone number as a simple string even though a tel URI may contain semicolon-delimited parameters such as ext, isub, and phone-context.^[1] If an application accepts these suffixes but different components validate, store, render, or forward them inconsistently, the suffix may reach an injection sink or bypass controls based on exact string comparison. Test for XSS, SQL injection, SSRF, parser discrepancies, and downstream telephony issues only where the application’s data flow makes the corresponding sink plausible.^[2]

Structure of a telephone URI with a global or local number and optional parameters — Telephone URI structure and common optional parameters.

Examples of malicious phone-number parameters targeting XSS, SSRF, OTP rate limits, and telephony parsers — Potential issues caused by inconsistent handling of phone-number parameters.

OTP Rate-Limit Bypass

If a rate limiter keys attempts by the exact submitted string but the delivery provider normalizes multiple parameterized values to the same destination, an attacker may rotate suffixes to obtain separate attempt counters for one account. The figure illustrates the concept with changing ext values; successful exploitation depends on the application’s and provider’s normalization behavior.^[2]

OTP spraying example that rotates telephone URI extension values to obtain separate rate-limit counters — Conceptual OTP spraying through inconsistent phone-number normalization.